Security has not gotten easier these last few months. AI coding assistants have pushed the amount of code shipping every week far past what most AppSec teams planned for, and every new line is another place a vulnerability can land. AI has also put more zero-day exploits into circulation, so the time you have to fix a known issue keeps getting shorter.
Meanwhile, a lot of security teams are being asked to handle all of it with less. Budgets are flat or shrinking while the renewal quotes from security vendors keep climbing.
The result is a findings queue that grows faster than anyone can work it down. Your scanners find more every sprint, and your engineers still have the same number of hours to fix what they find.
Most security tooling is priced on what happens before anything gets fixed. You pay per seat, per scanner, per asset, or by the size of your company. None of those numbers move when a vulnerability actually gets closed.
Our team has had enough of that model. What you want from a security tool is fewer open vulnerabilities, and that's what we'd rather be measured on.
That's the idea behind Sensei, DefectDojo's AI. Connect a repository and Sensei scans it, brings the results into DefectDojo as findings, and opens pull requests that fix them. Sensei counts its work in fixes: one approved fix opens one pull request. By default, nothing opens until you approve it, and every fix lands as a normal pull request your team reviews and merges like any other change.
Finding vulnerabilities stopped being the hard part a while ago. Many teams run several scanners and already have more findings than they can work through. The bottleneck is the fix: someone has to read the finding, work out the change, write it, test it, and get it into a pull request. Multiply that by every finding in the queue and you have the backlog.
Security teams usually don't own the code they're asked to secure, so the default workflow is a ticket. The ticket lands with a developer whose sprint is already full, and the finding waits. Auto-remediation changes what security hands over. Instead of a ticket describing a problem, the developer gets a pull request with the fix already written and ready for review.
That matters more now than it did a year ago. If AI is writing a growing share of your code, a remediation process that depends on someone hand-writing every fix falls further behind every month. Fixes have to keep pace with the code.
Sensei gives you two ways to work. You can approve fixes one at a time from the findings table, or turn on automatic remediation for a repository and let Sensei open fix pull requests on its own, up to your fix limit. Either way, someone on your team reviews and merges every change, so you decide what reaches your code.
October is Cybersecurity Awareness Month, so from today through November 13, we're giving out 1,000 free fixes with DefectDojo Sensei. No strings attached, and no small print.
Point Sensei at a test repo or a private repo and see how many vulnerabilities it can fix in your own code. Turn on automatic remediation for that repo and let Sensei work through the findings without waiting on you. Every fix arrives as a pull request, so you can read each change, merge the ones you want, and close the rest.
The offer is open to new users and to existing DefectDojo customers. Sensei is currently in beta and works with GitHub and GitLab repositories.
Getting your first fix takes three steps:
Already a customer? Your 1,000 fixes are already turned on.
The offer ends November 13. Read the Sensei documentation for setup details, then sign up and start fixing.